system-configuration

ene.scm

;;; Tyreunom's system administration and configuration tools.
;;;
;;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu>
;;;
;;; This program is free software: you can redistribute it and/or modify
;;; it under the terms of the GNU General Public License as published by
;;; the Free Software Foundation, either version 3 of the License, or
;;; (at your option) any later version.
;;;
;;; This program is distributed in the hope that it will be useful,
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

(use-modules (gnu))
(use-modules (gnu bootloader))
(use-modules (gnu bootloader u-boot))
(use-modules (gnu packages bootloaders))
(use-modules (gnu packages dns))
(use-modules (gnu services dns))
(use-modules (gnu services mail))
(use-modules (gnu services networking))
(use-modules (gnu services version-control))
(use-modules (gnu services web))
(use-modules (gnu system))

(use-modules (gnu packages libunwind))
(use-modules (gnu packages mail))
(use-modules (gnu packages web))
(use-modules (guix packages))
(use-modules (guix utils))
(use-modules (guix transformations))

(use-modules (config certbot) (config dns) (config iptables)
             (config mail) (config os) (config static-web)
	     (config web)
	     (services gitile) (packages gitile))

;; Copy from (gnu bootloader u-boot)
(define install-allwinner-u-boot
  #~(lambda (bootloader device mount-point)
      (let ((u-boot (string-append bootloader
                                   "/libexec/u-boot-sunxi-with-spl.bin")))
        (write-file-on-device u-boot (stat:size (stat u-boot))
                              device (* 8 1024)))))

(define u-boot-cubietruck-bootloader
  (bootloader
    (inherit u-boot-bootloader)
    (package u-boot-cubietruck)
    (installer install-allwinner-u-boot)))

(operating-system
  (inherit (tyreunom-os "ene"))
  (bootloader
    (bootloader-configuration
      (target "/dev/mmcblk0")
      (bootloader u-boot-cubietruck-bootloader)))
  (initrd-modules (cons* "sunxi-mmc" "sd_mod" "ahci_sunxi" %base-initrd-modules))
  (file-systems (cons (file-system
                        (mount-point "/")
                        (device "/dev/sda1")
                        (type "ext4"))
                      %base-file-systems))
  (services
    (append
      (list
        (service dhcp-client-service-type)
        lepiller-iptables-service
        (agetty-service
          (agetty-configuration
            (extra-options '("-L"))
            (baud-rate "115200")
            (term "vt100")
            (tty "ttyS0")))
        (service tor-service-type)
        (tor-hidden-service "mail"
                            '((25 "127.0.0.1:25")
                              (143 "127.0.0.1:143")
                              (587 "127.0.0.1:587")
                              (993 "127.0.0.1:993")))
        (service knot-service-type
                 (knot-configuration
		   (knot
		     ((options->transformation '((without-tests . "protobuf")))
		       knot))
                   (includes '("/etc/knot/secrets.conf"))
                   (acls (list master-acl))
                   (remotes (list hermes))
                   (zones (list lepiller-master-zone
                                ipv4-reverse-master-zone
                                ipv6-reverse-master-zone))))
        (certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu")
                           ("ene.lepiller.eu" "rennes.lepiller.eu")
                           ("avatar.lepiller.eu")
                           ("git.lepiller.eu")
			   ("social.lepiller.eu")))
        (service nginx-service-type)
        (service php-fpm-service-type)
        (service fcgiwrap-service-type
                 (fcgiwrap-configuration
                   (group "git")))
        (cat-avatar-generator-service
          #:configuration
          (nginx-server-configuration
            (server-name '("avatar.lepiller.eu"))
            (ssl-certificate
              "/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")
            (ssl-certificate-key
              "/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")
            (listen '("443 ssl http2" "[::]:443 ssl http2"))))
        (simple-service 'default-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/ene.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '(default))(root "/srv/http/default"))))
        (simple-service 'social-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate "/etc/letsencrypt/live/social.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key "/etc/letsencrypt/live/social.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("social.lepiller.eu"))
                  (root "/srv/http/social/public")
                  (locations
                    (list
		      (nginx-location-configuration
			(uri "/content/")
			(body '("alias /var/lib/social/user-data/public/;")))
                      (nginx-location-configuration
                        (uri "/")
                        (body '("proxy_pass http://localhost:8081;")))))
                  (raw-content default-web-policy))))
	(service gitile-service-type)
        (simple-service 'git-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/git.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/git.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("git.lepiller.eu"))
                  (root "/srv/http/git/public")
                  (locations
                    (append
                      (list
                        (git-http-nginx-location-configuration
                          (git-http-configuration
                            (uri-path "/git/")
                            (git-root "/var/lib/gitolite/repositories")))
                        (nginx-location-configuration
                          (uri "/")
                          (body
                            (list
                              "proxy_pass http://127.0.0.1:8080/;"))))
                      (map
                        (lambda (loc)
                          (nginx-location-configuration
                            (uri loc)
                            (body
                              (list
                                "root /srv/http/git/public;"))))
                        '("/css" "/images" "~* .*/manual/.*" "= /"
                          "= /index.html")))))))
        (service static-web-site-service-type
                 (static-web-site-configuration
                  (git-url "https://git.lepiller.eu/git/guile-netlink")
                  (git-ref '(branch . "master"))
                  (directory "/srv/http/git/guile-netlink-manual")
                  (build-file "doc/build.scm")))
        ;; on activation, gitolite chmods its home directory to #o700, disabling
        ;; access to git-http-backend.  Re-enable that access.
        (simple-service 'gitolite-home-permissions
                        activation-service-type
                        #~(chmod "/var/lib/gitolite" #o750))
        (service gitolite-service-type
          (gitolite-configuration
            (admin-pubkey (local-file "../keys/tyreunom.pub"))
            (rc-file
              (gitolite-rc-file
                (umask #o0027)
                (git-config-keys ".*"))))))
      (modify-services
        (lepiller-mail-services
          #:interface "eth0"
          #:domain "courriel.lepiller.eu")
        (dovecot-service-type config =>
         (dovecot-configuration
           (inherit config)
           (dovecot (package
                      (inherit dovecot)
                      (arguments
                        `(#:tests? #f
                          ,@(package-arguments dovecot))))))))
      (server-services "ene"))))


1	;;; Tyreunom's system administration and configuration tools.
2	;;;
3	;;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu>
4	;;;
5	;;; This program is free software: you can redistribute it and/or modify
6	;;; it under the terms of the GNU General Public License as published by
7	;;; the Free Software Foundation, either version 3 of the License, or
8	;;; (at your option) any later version.
9	;;;
10	;;; This program is distributed in the hope that it will be useful,
11	;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
12	;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	;;; GNU General Public License for more details.
14	;;;
15	;;; You should have received a copy of the GNU General Public License
16	;;; along with this program. If not, see <http://www.gnu.org/licenses/>.
17
18	(use-modules (gnu))
19	(use-modules (gnu bootloader))
20	(use-modules (gnu bootloader u-boot))
21	(use-modules (gnu packages bootloaders))
22	(use-modules (gnu packages dns))
23	(use-modules (gnu services dns))
24	(use-modules (gnu services mail))
25	(use-modules (gnu services networking))
26	(use-modules (gnu services version-control))
27	(use-modules (gnu services web))
28	(use-modules (gnu system))
29
30	(use-modules (gnu packages libunwind))
31	(use-modules (gnu packages mail))
32	(use-modules (gnu packages web))
33	(use-modules (guix packages))
34	(use-modules (guix utils))
35	(use-modules (guix transformations))
36
37	(use-modules (config certbot) (config dns) (config iptables)
38	(config mail) (config os) (config static-web)
39	(config web)
40	(services gitile) (packages gitile))
41
42	;; Copy from (gnu bootloader u-boot)
43	(define install-allwinner-u-boot
44	#~(lambda (bootloader device mount-point)
45	(let ((u-boot (string-append bootloader
46	"/libexec/u-boot-sunxi-with-spl.bin")))
47	(write-file-on-device u-boot (stat:size (stat u-boot))
48	device (* 8 1024)))))
49
50	(define u-boot-cubietruck-bootloader
51	(bootloader
52	(inherit u-boot-bootloader)
53	(package u-boot-cubietruck)
54	(installer install-allwinner-u-boot)))
55
56	(operating-system
57	(inherit (tyreunom-os "ene"))
58	(bootloader
59	(bootloader-configuration
60	(target "/dev/mmcblk0")
61	(bootloader u-boot-cubietruck-bootloader)))
62	(initrd-modules (cons* "sunxi-mmc" "sd_mod" "ahci_sunxi" %base-initrd-modules))
63	(file-systems (cons (file-system
64	(mount-point "/")
65	(device "/dev/sda1")
66	(type "ext4"))
67	%base-file-systems))
68	(services
69	(append
70	(list
71	(service dhcp-client-service-type)
72	lepiller-iptables-service
73	(agetty-service
74	(agetty-configuration
75	(extra-options '("-L"))
76	(baud-rate "115200")
77	(term "vt100")
78	(tty "ttyS0")))
79	(service tor-service-type)
80	(tor-hidden-service "mail"
81	'((25 "127.0.0.1:25")
82	(143 "127.0.0.1:143")
83	(587 "127.0.0.1:587")
84	(993 "127.0.0.1:993")))
85	(service knot-service-type
86	(knot-configuration
87	(knot
88	((options->transformation '((without-tests . "protobuf")))
89	knot))
90	(includes '("/etc/knot/secrets.conf"))
91	(acls (list master-acl))
92	(remotes (list hermes))
93	(zones (list lepiller-master-zone
94	ipv4-reverse-master-zone
95	ipv6-reverse-master-zone))))
96	(certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu")
97	("ene.lepiller.eu" "rennes.lepiller.eu")
98	("avatar.lepiller.eu")
99	("git.lepiller.eu")
100	("social.lepiller.eu")))
101	(service nginx-service-type)
102	(service php-fpm-service-type)
103	(service fcgiwrap-service-type
104	(fcgiwrap-configuration
105	(group "git")))
106	(cat-avatar-generator-service
107	#:configuration
108	(nginx-server-configuration
109	(server-name '("avatar.lepiller.eu"))
110	(ssl-certificate
111	"/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")
112	(ssl-certificate-key
113	"/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")
114	(listen '("443 ssl http2" "[::]:443 ssl http2"))))
115	(simple-service 'default-http-server nginx-service-type
116	(list (nginx-server-configuration
117	(ssl-certificate
118	"/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem")
119	(ssl-certificate-key
120	"/etc/letsencrypt/live/ene.lepiller.eu/privkey.pem")
121	(listen '("443 ssl http2" "[::]:443 ssl http2"))
122	(server-name '(default))(root "/srv/http/default"))))
123	(simple-service 'social-http-server nginx-service-type
124	(list (nginx-server-configuration
125	(ssl-certificate "/etc/letsencrypt/live/social.lepiller.eu/fullchain.pem")
126	(ssl-certificate-key "/etc/letsencrypt/live/social.lepiller.eu/privkey.pem")
127	(listen '("443 ssl http2" "[::]:443 ssl http2"))
128	(server-name '("social.lepiller.eu"))
129	(root "/srv/http/social/public")
130	(locations
131	(list
132	(nginx-location-configuration
133	(uri "/content/")
134	(body '("alias /var/lib/social/user-data/public/;")))
135	(nginx-location-configuration
136	(uri "/")
137	(body '("proxy_pass http://localhost:8081;")))))
138	(raw-content default-web-policy))))
139	(service gitile-service-type)
140	(simple-service 'git-server nginx-service-type
141	(list (nginx-server-configuration
142	(ssl-certificate
143	"/etc/letsencrypt/live/git.lepiller.eu/fullchain.pem")
144	(ssl-certificate-key
145	"/etc/letsencrypt/live/git.lepiller.eu/privkey.pem")
146	(listen '("443 ssl http2" "[::]:443 ssl http2"))
147	(server-name '("git.lepiller.eu"))
148	(root "/srv/http/git/public")
149	(locations
150	(append
151	(list
152	(git-http-nginx-location-configuration
153	(git-http-configuration
154	(uri-path "/git/")
155	(git-root "/var/lib/gitolite/repositories")))
156	(nginx-location-configuration
157	(uri "/")
158	(body
159	(list
160	"proxy_pass http://127.0.0.1:8080/;"))))
161	(map
162	(lambda (loc)
163	(nginx-location-configuration
164	(uri loc)
165	(body
166	(list
167	"root /srv/http/git/public;"))))
168	'("/css" "/images" "~* ./manual/." "= /"
169	"= /index.html")))))))
170	(service static-web-site-service-type
171	(static-web-site-configuration
172	(git-url "https://git.lepiller.eu/git/guile-netlink")
173	(git-ref '(branch . "master"))
174	(directory "/srv/http/git/guile-netlink-manual")
175	(build-file "doc/build.scm")))
176	;; on activation, gitolite chmods its home directory to #o700, disabling
177	;; access to git-http-backend. Re-enable that access.
178	(simple-service 'gitolite-home-permissions
179	activation-service-type
180	#~(chmod "/var/lib/gitolite" #o750))
181	(service gitolite-service-type
182	(gitolite-configuration
183	(admin-pubkey (local-file "../keys/tyreunom.pub"))
184	(rc-file
185	(gitolite-rc-file
186	(umask #o0027)
187	(git-config-keys ".*"))))))
188	(modify-services
189	(lepiller-mail-services
190	#:interface "eth0"
191	#:domain "courriel.lepiller.eu")
192	(dovecot-service-type config =>
193	(dovecot-configuration
194	(inherit config)
195	(dovecot (package
196	(inherit dovecot)
197	(arguments
198	`(#:tests? #f
199	,@(package-arguments dovecot))))))))
200	(server-services "ene"))))
201